@blamejs/core 0.6.61 → 0.6.62

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.6.x
 
+- **0.6.62** (2026-05-03) — URL-length DoS-shape gap closed in two places. **`b.safeSchema.string().url()`** was regex-only with no length cap, accepting arbitrarily long matching strings — same DoS class as v0.6.61's `.email()` gap; an operator chaining `.url()` on a request body would feed multi-megabyte URLs into downstream HTTP clients / SSRF gates / log lines. Now rejects with `string/url-too-long` at 8193+ chars. **`b.safeUrl.parse`** had the same gap at the framework's primary URL-validation surface (used by httpClient + ssrfGuard + every operator-supplied URL). The 8 KB cap now applies BEFORE handing the string to Node's `new URL()` parser; operator-supplied URLs feeding `b.httpClient.request({ url })` from request bodies / webhook configs are bounded. Operators with legitimate non-standard use (proxies, tunnels with embedded payloads) override via `opts.maxUrlLength`. Both bounds reference RFC 7230 §3.1.1's 8000-octet recommendation. **Tests** — 4 new layer-0 assertions on `string().url()` (8 KB / 8193 / 100K / error code) + 4 on `safeUrl.parse` (8192 accept / 8193 reject / error code / `maxUrlLength` opt override). Smoke 7215 → 7222 / wiki e2e 178 / Linux 85.5s / per-primitive integration 16 files / eslint clean / shellcheck clean.
+
 - **0.6.61** (2026-05-03) — `b.safeSchema.string().email()` enforces RFC 5321 §4.5.3.1.3's 254-character cap on the address. Pre-fix the validator was the regex-only `/^[^\s@]+@[^\s@]+\.[^\s@]+$/`, which accepts arbitrarily long matching strings — an operator chaining `.email()` on a request body was open to a DoS shape (50 KB email passes validation, downstream DB writes / log lines unbounded). Now `.email()` rejects with `string/email-too-long` at 255+ chars before the regex even runs, with a message naming the RFC. Operators with a legitimate non-RFC reason for longer addresses skip `.email()` and chain `.regex(custom)` directly. **Tests** — 4 new layer-0 assertions: 254-char address accepts, 255 / 500 char addresses reject, error code `string/email-too-long` exposed for operator handler routing. Smoke 7211 → 7215 / wiki e2e 178 / Linux 85.8s / eslint clean / shellcheck clean.
 
 - **0.6.60** (2026-05-03) — `b.pagination.encodeCursor` correctness fixes for non-plain types in cursor state. The `_canonicalize` walker did `if (typeof === "object") Object.keys(...)`, which silently lost data on three classes of input: **Date** silently encoded as `{}` (Date instances have no own enumerable keys); **Buffer / Uint8Array** silently encoded as `{"0":97,"1":98,…}` (indexed-key serialisation); **circular references** stack-overflowed instead of throwing a clean error. After encode → decode the operator's data was either gone or unrecognisable. The fix: Date now serialises to its ISO string (matches stdlib `JSON.stringify` semantics — round-trips through encode/decode as the ISO string operators expect); Buffer / Uint8Array / Map / Set / RegExp throw `pagination/bad-state` with a message naming the offending constructor and pointing operators at the right conversion (`"convert to a plain primitive (string / number / iso-string) first"`); circular references throw `pagination/bad-state` cleanly via WeakSet cycle detection. **Tests** — 7 new layer-0 assertions: Date round-trip preserved, all 5 non-plain types reject cleanly, circular reference rejects without stack overflow. Smoke 7204→7211 / wiki e2e 178 / Linux 85.3s / eslint clean / shellcheck clean.

package/lib/safe-schema.js

@@ -421,6 +421,17 @@ function _stringMethods(schema, spec) {
   };
   schema.url = function () {
     return chain(function (v, p) {
+      // RFC 9110 doesn't set a hard URL length, but RFC 7230 §3.1.1
+      // recommended 8000 octets and most HTTP origin servers + load
+      // balancers cap at 8 KB. Without this bound an operator chaining
+      // .url() on a request body was open to a 50 MB URL passing
+      // validation. Operators with a legitimate non-standard use
+      // (tunnels, proxies with embedded payloads) skip .url() and
+      // chain .regex(custom) directly.
+      if (v.length > 8192) {
+        return _fail(p, "string/url-too-long",
+          "must be a valid URL (max 8192 chars per RFC 7230 §3.1.1 guidance)");
+      }
       return URL_RE.test(v) ? { ok: true } :
         _fail(p, "string/url", "must be a valid URL");
     });

package/lib/safe-url.js

@@ -75,17 +75,37 @@ function _makeError(errorClass, code, message) {
   return new errorClass(code, message, true);
 }
 
+// RFC 7230 §3.1.1 recommended 8000 octets, RFC 9110 doesn't update.
+// Most HTTP origin servers + load balancers cap at 8 KB. Operators with
+// a legitimate non-standard use (proxies, tunnels with embedded
+// payloads) override via opts.maxUrlLength.
+var DEFAULT_MAX_URL_LENGTH = 8192;
+
 function parse(url, opts) {
   opts = opts || {};
   var allowed = Array.isArray(opts.allowedProtocols) && opts.allowedProtocols.length > 0
     ? opts.allowedProtocols
     : ALLOW_HTTP_TLS;
   var errClass = opts.errorClass;
+  var maxUrlLength = (typeof opts.maxUrlLength === "number" && opts.maxUrlLength > 0)
+    ? opts.maxUrlLength
+    : DEFAULT_MAX_URL_LENGTH;
 
   if (url == null || url === "") {
     throw _makeError(errClass, "safe-url/missing", "url is required");
   }
 
+  // Bound the URL string length BEFORE handing it to `new URL()`. Without
+  // this cap the framework would walk multi-megabyte URLs through Node's
+  // parser before the SSRF / protocol / userinfo gates even ran — a real
+  // DoS shape for operators feeding `b.httpClient.request({ url })` from
+  // request bodies / webhook configs.
+  if (typeof url === "string" && url.length > maxUrlLength) {
+    throw _makeError(errClass, "safe-url/too-long",
+      "URL exceeds " + maxUrlLength + " chars (got " + url.length +
+      "). RFC 7230 §3.1.1 recommends 8000; pass opts.maxUrlLength to override.");
+  }
+
   var parsed;
   if (url instanceof URL) {
     parsed = url;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.6.61",
+  "version": "0.6.62",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cyclonedx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:4c584992-71fc-4053-b097-fe6dc1dbb573",
+  "serialNumber": "urn:uuid:3ba1ea7f-af06-4625-bebf-f91c81f11992",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-05-03T13:46:27.072Z",
+    "timestamp": "2026-05-03T13:56:09.684Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.6.61",
+      "bom-ref": "@blamejs/core@0.6.62",
       "type": "library",
       "name": "blamejs",
-      "version": "0.6.61",
+      "version": "0.6.62",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.6.61",
+      "purl": "pkg:npm/%40blamejs/core@0.6.62",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.6.61",
+      "ref": "@blamejs/core@0.6.62",
       "dependsOn": []
     }
   ]